1 |
slords |
1.2 |
# $Id$ |
2 |
|
|
|
3 |
slords |
1.1 |
Summary: e-smith server and gateway - packetfilter add-on |
4 |
|
|
%define name e-smith-packetfilter |
5 |
|
|
Name: %{name} |
6 |
slords |
1.2 |
%define version 2.0.0 |
7 |
|
|
%define release 1 |
8 |
slords |
1.1 |
Version: %{version} |
9 |
|
|
Release: %{release}%{?dist} |
10 |
|
|
License: GPL |
11 |
|
|
Group: Networking/Daemons |
12 |
|
|
Source: %{name}-%{version}.tar.gz |
13 |
|
|
BuildRoot: /var/tmp/%{name}-%{version}-%{release}-buildroot |
14 |
|
|
BuildArchitectures: noarch |
15 |
|
|
Requires: e-smith-base >= 4.18.0 |
16 |
|
|
Requires: ulogd >= 1.24 |
17 |
|
|
Requires: daemontools |
18 |
|
|
Requires: iptables |
19 |
|
|
BuildRequires: e-smith-devtools |
20 |
|
|
Obsoletes: e-smith-ipmasq |
21 |
|
|
AutoReqProv: no |
22 |
|
|
|
23 |
|
|
%description |
24 |
|
|
e-smith server and gateway software - packetfilter add-on |
25 |
|
|
|
26 |
|
|
%changelog |
27 |
slords |
1.2 |
* Tue Oct 7 2008 Shad L. Lords <slords@mail.com> 2.0.0-1.sme |
28 |
|
|
- Roll new stream to separate sme7/sme8 trees [SME: 4633] |
29 |
|
|
|
30 |
slords |
1.1 |
* Fri May 18 2007 Shad L. Lords <slords@mail.com> 1.18.0-6 |
31 |
|
|
- Use correct lib for modules |
32 |
|
|
|
33 |
|
|
* Sun Apr 29 2007 Shad L. Lords <slords@mail.com> |
34 |
|
|
- Clean up spec so package can be built by koji/plague |
35 |
|
|
|
36 |
|
|
* Fri Apr 09 2007 Stephen Noble <support@dungog.net> 1.18.0-5 |
37 |
|
|
- Fix masq error in server only mode (cannot open UDPPort) [SME: 2812] |
38 |
|
|
|
39 |
|
|
* Fri Apr 06 2007 Shad L. Lords <slords@mail.com> 1.18.0-4 |
40 |
|
|
- Fix perms for ulogd.conf file [SME: 2722] |
41 |
|
|
|
42 |
|
|
* Mon Mar 19 2007 Shad L. Lords <slords@mail.com> 1.18.0-3 |
43 |
|
|
- Update ulogd.conf to new format [SME: 2744] |
44 |
|
|
|
45 |
|
|
* Fri Feb 09 2007 Shad L. Lords <slords@mail.com> 1.18.0-2 |
46 |
|
|
- Fix sorting for Ports properties [SME: 56] |
47 |
|
|
|
48 |
|
|
* Fri Jan 26 2007 Shad L. Lords <slords@mail.com> 1.18.0-1 |
49 |
|
|
- Roll stable stream. [SME: 2328] |
50 |
|
|
|
51 |
|
|
* Thu Jan 18 2007 Shad L. Lords <slords@mail.com> 1.17.0-7 |
52 |
|
|
- Move last masq fragments from e-smith-base. |
53 |
|
|
|
54 |
|
|
* Wed Jan 17 2007 Shad L. Lords <slords@mail.com> 1.17.0-6 |
55 |
|
|
- Use both {TCP,UDP}Port and {TCP,UDP}Ports for masq template [SME: 56] |
56 |
|
|
|
57 |
|
|
* Thu Dec 07 2006 Shad L. Lords <slords@mail.com> |
58 |
|
|
- Update to new release naming. No functional changes. |
59 |
|
|
- Make Packager generic |
60 |
|
|
|
61 |
|
|
* Fri Nov 23 2006 Gordon Rowell <gordonr@gormand.com.au> 1.17.0-04 |
62 |
|
|
- Remove TCPMinimizeDelay default for ssh [SME: 2083] |
63 |
|
|
|
64 |
|
|
* Mon Aug 28 2006 Charlie Brady <charlie_brady@mitel.com> 1.17.0-03 |
65 |
|
|
- Ensure that $OUTERNET is an IP address. [SME: 1815] |
66 |
|
|
|
67 |
|
|
* Sun Aug 13 2006 Charlie Brady <charlie_brady@mitel.com> 1.17.0-02 |
68 |
|
|
- Merge in masq fragments from e-smith-base. |
69 |
|
|
|
70 |
|
|
* Sun Aug 13 2006 Charlie Brady <charlie_brady@mitel.com> 1.17.0-01 |
71 |
|
|
- Roll new development stream. |
72 |
|
|
|
73 |
|
|
* Wed Jul 26 2006 Gordon Rowell <gordonr@gormand.com.au> 1.16.0-05 |
74 |
|
|
- Remove redundant auto-generated service-specific denylog rules from |
75 |
|
|
90InboundTCP10filter_{tcp,udp} [SME: 1776] |
76 |
|
|
|
77 |
|
|
* Tue Jul 18 2006 Charlie Brady <charlie_brady@mitel.com> 1.16.0-04 |
78 |
|
|
- Bundle fragments from e-smith-ipmasq and obsolete that RPM. [SME: 1002] |
79 |
|
|
|
80 |
|
|
* Tue Jun 20 2006 Filippo Carletti <carletti@mobilia.it> 1.16.0-03 |
81 |
|
|
- No longer drop UDP packets in serveronly mode [SME: 1002] |
82 |
|
|
|
83 |
|
|
* Thu Apr 6 2006 Gavin Weight <gweight@gmail.com> 1.2.0-02 |
84 |
|
|
- Make ident TCP reject configurable, based on oidentd status. |
85 |
|
|
If oidentd{status} is enabled, allow ident, otherwise REJECT it [SME: 85] |
86 |
|
|
|
87 |
|
|
* Wed Mar 15 2006 Charlie Brady <charlie_brady@mitel.com> 1.2.0-01 |
88 |
|
|
- Roll stable stream version. [SME: 1016] |
89 |
|
|
|
90 |
|
|
* Wed Nov 30 2005 Gordon Rowell <gordonr@gormand.com.au> 1.15.1-12 |
91 |
|
|
- Bump release number only |
92 |
|
|
|
93 |
|
|
* Wed Sep 21 2005 Charlie Brady <charlieb@e-smith.com> |
94 |
|
|
- [1.15.1-11] |
95 |
|
|
- Remove force/masq/status fragment, and fix "masq adjust" so |
96 |
|
|
that it is harmless if firewall is disabled. This leaves unsolved |
97 |
|
|
the problem of whether to toggle disabled->enabled during upgrades. |
98 |
|
|
[SF: 1261356] |
99 |
|
|
|
100 |
|
|
* Wed Sep 7 2005 Charlie Brady <charlieb@e-smith.com> |
101 |
|
|
- [1.15.1-10] |
102 |
|
|
- Fix location of force/status fragment for masq service. [SF: 1261356] |
103 |
|
|
|
104 |
|
|
* Tue Aug 30 2005 Charlie Brady <charlieb@e-smith.com> |
105 |
|
|
- [1.15.1-09] |
106 |
|
|
- Add force/status fragment for masq service, to force enabled. |
107 |
|
|
This ensures that firewall is running after a system upgrade, |
108 |
|
|
to avoid various panel failure modes. Solution to be reviewed |
109 |
|
|
for alternatives later. [SF: 1261356] |
110 |
|
|
|
111 |
|
|
* Fri Aug 26 2005 Charlie Brady <charlieb@e-smith.com> |
112 |
|
|
- [1.15.1-08] |
113 |
|
|
- Remove filtering of outbound ICMP - it's blocking legitimate ICMP |
114 |
|
|
redirects. [MN00093544] |
115 |
|
|
|
116 |
|
|
* Tue Aug 2 2005 Shad Lords <slords@email.com> |
117 |
|
|
- [1.15.1-07] |
118 |
|
|
- Add default $masq{Stealth} db entry |
119 |
|
|
|
120 |
|
|
* Tue Aug 2 2005 Gordon Rowell <gordonr@gormand.com.au> |
121 |
|
|
- [1.15.1-06] |
122 |
|
|
- Rejct IDENT with a TCP reset [SF: 1240659] |
123 |
|
|
- Add support for UDPPort (c.f. TCPPort) property to allow |
124 |
|
|
filtered UDP [SF: 1241398] |
125 |
|
|
- Add support for DenyHosts property (see 1.15.0-02 for AllowHosts) |
126 |
|
|
[SF: 1241398] |
127 |
|
|
|
128 |
|
|
* Mon Jul 18 2005 Charlie Brady <charlieb@e-smith.com> |
129 |
|
|
- [1.15.1-05] |
130 |
|
|
- Tidy up path reference to networks db. [SF: 1216546] |
131 |
|
|
|
132 |
|
|
* Tue Jun 7 2005 Charlie Brady <charlieb@e-smith.com> |
133 |
|
|
- [1.15.1-04] |
134 |
|
|
- Fix ulogd logging to stdout not being captured by multilog. |
135 |
|
|
|
136 |
|
|
* Mon May 2 2005 Charlie Brady <charlieb@e-smith.com> |
137 |
|
|
- [1.15.1-03] |
138 |
|
|
- Add requires headers for ulogd and daemontools. |
139 |
|
|
|
140 |
|
|
* Sun May 1 2005 Charlie Brady <charlieb@e-smith.com> |
141 |
|
|
- [1.15.1-02] |
142 |
|
|
- Switch to logging via ulogd and multilog. |
143 |
|
|
|
144 |
|
|
* Sun May 1 2005 Charlie Brady <charlieb@e-smith.com> |
145 |
|
|
- [1.15.1-01] |
146 |
|
|
- Roll new development stream - 1.15.1 |
147 |
|
|
|
148 |
|
|
* Wed Mar 30 2005 Charlie Brady <charlieb@e-smith.com> |
149 |
|
|
- [1.15.0-15] |
150 |
|
|
- Set $OUTERNET to equal $LocalIP in masq script in serveronly mode, |
151 |
|
|
so that masq script (if enabled) does not block allowed public access. |
152 |
|
|
- Remove various 45Allow* fragments as TCPPort properties of services |
153 |
|
|
will allow access if public access is enabled. |
154 |
|
|
|
155 |
|
|
* Fri Nov 12 2004 Tony Clayton <apc@e-smith.com> |
156 |
|
|
- [1.15.0-14] |
157 |
|
|
- More cleanup for iptables-trace [tonyc] |
158 |
|
|
|
159 |
|
|
* Fri Nov 12 2004 Tony Clayton <apc@e-smith.com> |
160 |
|
|
- [1.15.0-13] |
161 |
|
|
- update to latest iptables-trace [tonyc] : |
162 |
|
|
- add logging for default chain policy fallback |
163 |
|
|
- fix stop() bug causing _any_ rules with --log-prefix to be removed |
164 |
|
|
|
165 |
|
|
* Fri Apr 30 2004 Michael Soulier <msoulier@e-smith.com> |
166 |
|
|
- [1.15.0-12] |
167 |
|
|
- Made TOS settings configurable, with just ssh set by default. |
168 |
|
|
[msoulier dpar-28993] |
169 |
|
|
|
170 |
|
|
* Wed Feb 25 2004 Michael Soulier <msoulier@e-smith.com> |
171 |
|
|
- [1.15.0-11] |
172 |
|
|
- Tightened rules for remote vpn subnets. [msoulier dpar-21836] |
173 |
|
|
|
174 |
|
|
* Wed Jan 28 2004 Michael Soulier <msoulier@e-smith.com> |
175 |
|
|
- [1.15.0-10] |
176 |
|
|
- Fixed iptables-trace "stop" removing rules from the denylog chain. |
177 |
|
|
[msoulier 10955] |
178 |
|
|
|
179 |
|
|
* Wed Jan 28 2004 Michael Soulier <msoulier@e-smith.com> |
180 |
|
|
- [1.15.0-09] |
181 |
|
|
- Added a toggle of the trace option during adjust, so adjusts work with trace |
182 |
|
|
enabled. [msoulier 8117] |
183 |
|
|
|
184 |
|
|
* Mon Dec 1 2003 Michael Soulier <msoulier@e-smith.com> |
185 |
|
|
- [1.15.0-08] |
186 |
|
|
- Changed multicast DROP target to denylog, so it toggles. [msoulier 9450] |
187 |
|
|
|
188 |
|
|
* Mon Dec 1 2003 Michael Soulier <msoulier@e-smith.com> |
189 |
|
|
- [1.15.0-07] |
190 |
|
|
- Changed the toggle property name to DenylogTarget. [msoulier 9450] |
191 |
|
|
|
192 |
|
|
* Mon Dec 1 2003 Michael Soulier <msoulier@e-smith.com> |
193 |
|
|
- [1.15.0-06] |
194 |
|
|
- Added firewall-wide toggle for denylog DROP/REJECT. [msoulier 9450] |
195 |
|
|
|
196 |
|
|
* Sat Nov 29 2003 Charlie Brady <charlieb@e-smith.com> |
197 |
|
|
- [1.15.0-05] |
198 |
|
|
- Ensure that masq script expands without error in serveronly mode. |
199 |
|
|
[charlieb 10162] |
200 |
|
|
|
201 |
|
|
* Sat Oct 4 2003 Michael Soulier <msoulier@e-smith.com> |
202 |
|
|
- [1.15.0-04] |
203 |
|
|
- Fixed error in masq fragment with stealth enabled. [msoulier 10165] |
204 |
|
|
|
205 |
|
|
* Thu Sep 25 2003 Gordon Rowell <gordonr@e-smith.com> |
206 |
|
|
- [1.15.0-03] |
207 |
|
|
- Add masq to 0.0.0.0/0 for public, unrestricted [gordonr 10050] |
208 |
|
|
|
209 |
|
|
* Tue Sep 23 2003 Gordon Rowell <gordonr@e-smith.com> |
210 |
|
|
- [1.15.0-02] |
211 |
|
|
- New fragment 90InboundTCP10filter_tcp, a further step towards |
212 |
|
|
auto-generation of rules, removing the 45Allow* fragments: |
213 |
|
|
|
214 |
|
|
For all services which have a TCPPort property defined: |
215 |
|
|
If the service is 'enabled' and the service is 'public', |
216 |
|
|
generate iptables rules as follows: |
217 |
|
|
If an AllowHosts property is defined, allow only those hosts |
218 |
|
|
Otherwise allow all hosts |
219 |
|
|
|
220 |
|
|
AllowHosts is comma separated, and can contain IPs, IP/mask and CIDR |
221 |
|
|
|
222 |
|
|
This will generate duplicate rules until the 45Allow* fragments |
223 |
|
|
are removed, which can happen once the TCPPort property is defined |
224 |
|
|
for a service. |
225 |
|
|
|
226 |
|
|
QUERY: Should this be TCPPort (singular) or TCPPorts (plural)? |
227 |
|
|
TODO: Create db defaults fragments to deprecate the 45Allow* fragments |
228 |
|
|
TODO: Possibly add DenyHosts processing [gordonr 10050] |
229 |
|
|
|
230 |
|
|
* Tue Sep 23 2003 Gordon Rowell <gordonr@e-smith.com> |
231 |
|
|
- [1.15.0-01] |
232 |
|
|
- Changing version to development stream number - 1.15.0 |
233 |
|
|
- Dev stream [gordonr 10050] |
234 |
|
|
|
235 |
|
|
* Thu Jun 26 2003 Charlie Brady <charlieb@e-smith.com> |
236 |
|
|
- [1.14.0-01] |
237 |
|
|
- Changing version to stable stream number - 1.14.0 |
238 |
|
|
|
239 |
|
|
* Tue Jun 17 2003 Tony Clayton <apc@e-smith.com> |
240 |
|
|
- [1.13.0-27] |
241 |
|
|
- Again [tonyc 8578] |
242 |
|
|
|
243 |
|
|
* Tue Jun 17 2003 Tony Clayton <apc@e-smith.com> |
244 |
|
|
- [1.13.0-26] |
245 |
|
|
- Add lo->lo ACCEPT rule back to 90local_chk00Start fragment [tonyc 8578] |
246 |
|
|
|
247 |
|
|
* Mon Jun 16 2003 Tony Clayton <apc@e-smith.com> |
248 |
|
|
- [1.13.0-25] |
249 |
|
|
- Split 90AllowLocal masq fragment into 90local_chk* [tonyc 8578] |
250 |
|
|
|
251 |
|
|
* Mon Jun 2 2003 Michael Soulier <msoulier@e-smith.com> |
252 |
|
|
- [1.13.0-24] |
253 |
|
|
- Explicitely blocking multicast not from a local network. |
254 |
|
|
[msoulier 6031] |
255 |
|
|
|
256 |
|
|
* Thu May 1 2003 Michael Soulier <msoulier@e-smith.com> |
257 |
|
|
- [1.13.0-23] |
258 |
|
|
- Added chain creation during adjust. What a thought. [msoulier 7695] |
259 |
|
|
|
260 |
|
|
* Thu May 1 2003 Michael Soulier <msoulier@e-smith.com> |
261 |
|
|
- [1.13.0-22] |
262 |
|
|
- Added support for a PPPconn chain to track rules to permit PPTP connections. |
263 |
|
|
[msoulier 7695] |
264 |
|
|
|
265 |
|
|
* Fri Apr 25 2003 Michael Soulier <msoulier@e-smith.com> |
266 |
|
|
- [1.13.0-21] |
267 |
|
|
- Refactored the 90adjustUDP template into multiple fragments. [msoulier 8505] |
268 |
|
|
|
269 |
|
|
* Fri Apr 25 2003 Michael Soulier <msoulier@e-smith.com> |
270 |
|
|
- [1.13.0-20] |
271 |
|
|
- Refactored the 90adjustTCP template into multiple fragments. [msoulier 8505] |
272 |
|
|
|
273 |
|
|
* Tue Apr 22 2003 Michael Soulier <msoulier@e-smith.com> |
274 |
|
|
- [1.13.0-19] |
275 |
|
|
- Accepting all traffic from the loopback interface. [msoulier 8299] |
276 |
|
|
|
277 |
|
|
* Mon Apr 21 2003 Michael Soulier <msoulier@e-smith.com> |
278 |
|
|
- [1.13.0-18] |
279 |
|
|
- Removed acceptance of anything not from the external interface. The local |
280 |
|
|
networks list should be sufficient. [msoulier 8299] |
281 |
|
|
|
282 |
|
|
* Mon Apr 21 2003 Michael Soulier <msoulier@e-smith.com> |
283 |
|
|
- [1.13.0-17] |
284 |
|
|
- Added handling of local_chk chain in adjustment. [msoulier 8299] |
285 |
|
|
|
286 |
|
|
* Mon Apr 14 2003 Gordon Rowell <gordonr@e-smith.com> |
287 |
|
|
- [1.13.0-16] |
288 |
|
|
- Flag pptp masq as on by default [gordonr 6694] |
289 |
|
|
|
290 |
|
|
* Tue Apr 8 2003 Michael Soulier <msoulier@e-smith.com> |
291 |
|
|
- [1.13.0-15] |
292 |
|
|
- Added iptables-trace in /etc/rc.d/init.d. [msoulier 7613] |
293 |
|
|
|
294 |
|
|
* Tue Apr 1 2003 Gordon Rowell <gordonr@e-smith.com> |
295 |
|
|
- [1.13.0-14] |
296 |
|
|
- Added denylog: prefix to denied packet logs [gordonr 6852] |
297 |
|
|
|
298 |
|
|
* Tue Mar 25 2003 Michael Soulier <msoulier@e-smith.com> |
299 |
|
|
- [1.13.0-13] |
300 |
|
|
- Portforwarding still had problems, fixed here. [msoulier 7284] |
301 |
|
|
|
302 |
|
|
* Tue Mar 25 2003 Michael Soulier <msoulier@e-smith.com> |
303 |
|
|
- [1.13.0-12] |
304 |
|
|
- Added ForwardedTCP and ForwardedUDP, as well as supporting code to |
305 |
|
|
permit certain ports to be opened for forwarded traffic inbound. Required |
306 |
|
|
for portforwarding. [msoulier 7284] |
307 |
|
|
|
308 |
|
|
* Fri Mar 7 2003 Charlie Brady <charlieb@e-smith.com> |
309 |
|
|
- [1.13.0-11] |
310 |
|
|
- Add "use esmith::util" to 01localNetworks fragment. Needed if |
311 |
|
|
esmith::templates form of processTemplate is used. [charlieb 5650] |
312 |
|
|
|
313 |
|
|
* Fri Feb 21 2003 Gordon Rowell <gordonr@e-smith.com> |
314 |
|
|
- [1.13.0-10] |
315 |
|
|
- Remove quotes around 'Name' - not required [gordonr 7343] |
316 |
|
|
|
317 |
|
|
* Fri Feb 21 2003 Gordon Rowell <gordonr@e-smith.com> |
318 |
|
|
- [1.13.0-09] |
319 |
|
|
- Make use of ExternalInterface definition in 00Definitions [gordonr 7343] |
320 |
|
|
- Update dependency on e-smithbase [gordonr 7343] |
321 |
|
|
|
322 |
|
|
* Mon Feb 3 2003 Mark Knox <markk@e-smith.com> |
323 |
|
|
- [1.13.0-08] |
324 |
|
|
- Open port 443 when either web server is enabled [markk 6428] |
325 |
|
|
|
326 |
|
|
* Fri Jan 24 2003 Charlie Brady <charlieb@e-smith.com> |
327 |
|
|
- [1.13.0-07] |
328 |
|
|
- Fix one last broken here document. [charlieb 6651] |
329 |
|
|
|
330 |
|
|
* Thu Jan 23 2003 Charlie Brady <charlieb@e-smith.com> |
331 |
|
|
- [1.13.0-06] |
332 |
|
|
- Fix a few typos in previous round of masq fragment changes. [charlieb] |
333 |
|
|
|
334 |
|
|
* Thu Jan 23 2003 Charlie Brady <charlieb@e-smith.com> |
335 |
|
|
- [1.13.0-05] |
336 |
|
|
- formatting changes in masq/00Functions template fragment [charlieb] |
337 |
|
|
- Use connection tracking on both INPUT and FORWARD tables [charlieb 6651] |
338 |
|
|
- Allow any local traffic on INPUT and FORWARD chains. Local traffic |
339 |
|
|
is currently defined as all traffic which didn't come in via the |
340 |
|
|
external interface. That definition can easily change, as there is |
341 |
|
|
a special chain for accepting local traffic. [charlieb 6709] |
342 |
|
|
- Remove explicit allow of multicast traffic, as it is a subset of "local" |
343 |
|
|
traffic [charlieb 6031, 6709] |
344 |
|
|
- Move ICMP type checking into "adjust" part of masq script [charlieb 6709] |
345 |
|
|
|
346 |
|
|
* Sat Jan 18 2003 Michael Soulier <msoulier@e-smith.com> |
347 |
|
|
- [1.13.0-04] |
348 |
|
|
- Permitting multicast traffic to and from the internal interface. |
349 |
|
|
[msoulier 6031] |
350 |
|
|
|
351 |
|
|
* Wed Jan 15 2003 Gordon Rowell <gordonr@e-smith.com> |
352 |
|
|
- [1.13.0-03] |
353 |
|
|
- Put back non-redundant DROP lines, but add a comment as to why |
354 |
|
|
they are there [gordonr 6580] |
355 |
|
|
|
356 |
|
|
* Wed Jan 15 2003 Gordon Rowell <gordonr@e-smith.com> |
357 |
|
|
- [1.13.0-02] |
358 |
|
|
- Remove redundant DROP lines from denylog chain [gordonr 6580] |
359 |
|
|
|
360 |
|
|
* Thu Jan 9 2003 Mark Knox <markk@e-smith.com> |
361 |
|
|
- [1.13.0-01] |
362 |
|
|
- Forced version update by co2rpm to 1.13.0 |
363 |
|
|
|
364 |
|
|
* Mon Dec 16 2002 Charlie Brady <charlieb@e-smith.com> |
365 |
|
|
- [1.12.0-01] |
366 |
|
|
- Roll to stable version to 1.12.0 |
367 |
|
|
|
368 |
|
|
* Fri Nov 29 2002 Michael Soulier <msoulier@e-smith.com> |
369 |
|
|
- [1.11.0-07] |
370 |
|
|
- Added a get_safe_id function, to factor out firewall rule scanning code, and |
371 |
|
|
prevent chain name clashes in the extreme case. [msoulier 5696] |
372 |
|
|
|
373 |
|
|
* Thu Nov 28 2002 Michael Soulier <msoulier@e-smith.com> |
374 |
|
|
- [1.11.0-06] |
375 |
|
|
- Removed specific tcp_in and udp_in chains in favour of the InboundTCP_$$ and |
376 |
|
|
InboundUDP__$$ chains. They are far, far easier to manage, especially for |
377 |
|
|
the portforwarding blade. [msoulier 5696] |
378 |
|
|
|
379 |
|
|
* Wed Nov 20 2002 Charlie Brady <charlieb@e-smith.com> |
380 |
|
|
- [1.11.0-05] |
381 |
|
|
- Make sure that --numeric is used with any --list command, to avoid |
382 |
|
|
reverse lookup delays. [charlieb 5644] |
383 |
|
|
|
384 |
|
|
* Wed Nov 13 2002 Charlie Brady <charlieb@e-smith.com> |
385 |
|
|
- [1.11.0-04] |
386 |
|
|
- Peel off ICMP for checking after packets for ESTABLISHED and RELATED |
387 |
|
|
connections are allowed. This allows outbound ping to work. [charlieb 5423] |
388 |
|
|
|
389 |
|
|
* Mon Nov 11 2002 Charlie Brady <charlieb@e-smith.com> |
390 |
|
|
- [1.11.0-03] |
391 |
|
|
- Apply UDP filtering only on traffic entering via external |
392 |
|
|
interface. [charlieb 5644] |
393 |
|
|
|
394 |
|
|
* Mon Nov 11 2002 Charlie Brady <charlieb@e-smith.com> |
395 |
|
|
- [1.11.0-02] |
396 |
|
|
- Add UDP input filter setup and adjust rules. |
397 |
|
|
Re-arrange 00Functions a bit so that perl block is |
398 |
|
|
shorter and the rest is in-line [charlieb 5644] |
399 |
|
|
- Move adjustEnd to 92, to allow 91 hole for any adjustments |
400 |
|
|
needing to be done after input filter rules are adjusted |
401 |
|
|
(e.g. port forwarding). |
402 |
|
|
|
403 |
|
|
* Mon Nov 11 2002 Charlie Brady <charlieb@e-smith.com> |
404 |
|
|
- [1.11.0-01] |
405 |
|
|
- rolling development stream to 1.11.0 |
406 |
|
|
|
407 |
|
|
* Sat Oct 19 2002 Charlie Brady <charlieb@e-smith.com> |
408 |
|
|
- [1.10.0-08] |
409 |
|
|
- Send default packets on the FORWARD filter to denylog, rather than |
410 |
|
|
DROP. [charlieb 5246] |
411 |
|
|
- Revert 2) from 1.10.0-05 checkin. 5.5 ipchains forwarding rules do not allow |
412 |
|
|
IP masqueraded packets. [charlieb 5246] |
413 |
|
|
|
414 |
|
|
* Fri Oct 18 2002 Charlie Brady <charlieb@e-smith.com> |
415 |
|
|
- [1.10.0-07] |
416 |
|
|
- Commit new file 42CheckTCPInput which was missed in last checkin. |
417 |
|
|
[charlieb 5246] |
418 |
|
|
|
419 |
|
|
* Fri Oct 18 2002 Charlie Brady <charlieb@e-smith.com> |
420 |
|
|
- [1.10.0-06] |
421 |
|
|
- Create a new intermediate TCP input chain, and create a new temporary |
422 |
|
|
TCP input chain whenever we run "masq adjust". This ensures that |
423 |
|
|
new TCP input checking rules occur at the same place during input |
424 |
|
|
checking as existing rules, and also means that rules previously created |
425 |
|
|
by now-removed packages disappear. [charlieb 4501, 5246] |
426 |
|
|
|
427 |
|
|
* Thu Oct 17 2002 Charlie Brady <charlieb@e-smith.com> |
428 |
|
|
- [1.10.0-05] |
429 |
|
|
- Fix to the previous change 1) to restore some commented out rules, |
430 |
|
|
and 2) to fix those rules so that they match the 5.5 ipchains |
431 |
|
|
version. [charlieb 5246] |
432 |
|
|
|
433 |
|
|
* Thu Oct 17 2002 Charlie Brady <charlieb@e-smith.com> |
434 |
|
|
- [1.10.0-04] |
435 |
|
|
- Changes so that local networks can be added/deleted and "masq adjust" |
436 |
|
|
will correctly re-adjust the filters. [charlieb 5246] |
437 |
|
|
|
438 |
|
|
* Tue Oct 15 2002 Charlie Brady <charlieb@e-smith.com> |
439 |
|
|
- [1.10.0-03] |
440 |
|
|
- Change 00Functions so that "tcp_in" function can create chains as required |
441 |
|
|
during "masq adjust", so that new modules can add rules and still avoid |
442 |
|
|
"masq restart". [charlieb 4501] |
443 |
|
|
|
444 |
|
|
* Tue Oct 15 2002 Mark Knox <markk@e-smith.com> |
445 |
|
|
- [1.10.0-02] |
446 |
|
|
- Re-add echo-reply support (doesn't work with conntrack) [markk 5213] |
447 |
|
|
|
448 |
|
|
* Sat Oct 12 2002 Charlie Brady <charlieb@e-smith.com> |
449 |
|
|
- [1.10.0-01] |
450 |
|
|
- Roll to maintained version number to 1.10.0 |
451 |
|
|
- Remove "perl createlinks" from %build section, since we no longer |
452 |
|
|
have a createlinks file. |
453 |
|
|
|
454 |
|
|
* Fri Oct 11 2002 Gordon Rowell <gordonr@e-smith.com> |
455 |
|
|
- [1.9.15-07] |
456 |
|
|
- Check the correct configDB entry for public POP [gordonr 5181] |
457 |
|
|
|
458 |
|
|
* Tue Oct 8 2002 Mark Knox <markk@e-smith.com> |
459 |
|
|
- [1.9.15-06] |
460 |
|
|
- Use denylog target for dropped ICMP packets [markk 5095] |
461 |
|
|
- Remove explicit echo-reply support (we use conntrack now) [markk 5095] |
462 |
|
|
|
463 |
|
|
* Mon Oct 7 2002 Mark Knox <markk@e-smith.com> |
464 |
|
|
- [1.9.15-05] |
465 |
|
|
- Drop ICMP echo-requests on ext i/f when in private s/g mode or if Stealth |
466 |
|
|
property is set. General cleanup of ICMP rules. [markk 5095] |
467 |
|
|
|
468 |
|
|
* Wed Sep 11 2002 Gordon Rowell <gordonr@e-smith.com> |
469 |
|
|
- [1.9.15-04] |
470 |
|
|
- Added extra slosh in tcp_in as one gets gobbled by template evaluation |
471 |
|
|
and we need one in the final output. Reformatted the lines and moved |
472 |
|
|
proto/port together on first line of pair for readability [gordonr 4792] |
473 |
|
|
|
474 |
|
|
* Thu Sep 5 2002 Charlie Brady <charlieb@e-smith.com> |
475 |
|
|
- [1.9.15-03] |
476 |
|
|
- Fix tcp_in function - it doesn't work too well without the jump to the |
477 |
|
|
newly defined rule. Change DROP to denylog in the placeholder rule, |
478 |
|
|
even though it is short-lived. [charlieb 4792] |
479 |
|
|
|
480 |
|
|
* Mon Sep 2 2002 Charlie Brady <charlieb@e-smith.com> |
481 |
|
|
- [1.9.15-02] |
482 |
|
|
- Remove createlinks script and network-{create,delete} event directories - |
483 |
|
|
the required change was made in e-smith-base, and this shouldn't have |
484 |
|
|
been checked in. [charlieb 4501] |
485 |
|
|
|
486 |
|
|
* Wed Aug 28 2002 Charlie Brady <charlieb@e-smith.com> |
487 |
|
|
- [1.9.15-01] |
488 |
|
|
- Rolling minor version number to work around wrinkle in co2rpm [charlieb 3700] |
489 |
|
|
|
490 |
|
|
* Wed Aug 28 2002 Charlie Brady <charlieb@e-smith.com> |
491 |
|
|
- [1.9.14-04] |
492 |
|
|
- Remove 45AllowAUTH masq fragment - moved to e-smith-oidentd package. |
493 |
|
|
[charlieb 4435] |
494 |
|
|
|
495 |
|
|
* Tue Aug 27 2002 Charlie Brady <charlieb@e-smith.com> |
496 |
|
|
- [1.9.14-03] |
497 |
|
|
- Fix iptables syntax in AdjustTOS fragment [charlieb 1268] |
498 |
|
|
|
499 |
|
|
* Mon Aug 26 2002 Charlie Brady <charlieb@e-smith.com> |
500 |
|
|
- [1.9.14-02] |
501 |
|
|
- Fix AllowICMPfromLAN template error [charlieb 1268] |
502 |
|
|
|
503 |
|
|
* Thu Aug 22 2002 Charlie Brady <charlieb@e-smith.com> |
504 |
|
|
- [1.9.14-01] |
505 |
|
|
- Use full iptables path in status fragment - allows "service masq status" to |
506 |
|
|
work. [charlieb 1268] |
507 |
|
|
- Fix local networks list [charlieb 1268] |
508 |
|
|
|
509 |
|
|
* Tue Aug 20 2002 Charlie Brady <charlieb@e-smith.com> |
510 |
|
|
- [1.9.13-01] |
511 |
|
|
- Fix syntax in 30adjustTOS fragment. Move definitions to start of masq |
512 |
|
|
script where they can be used in functions. [charlieb 4501] |
513 |
|
|
|
514 |
|
|
* Mon Aug 19 2002 Charlie Brady <charlieb@e-smith.com> |
515 |
|
|
- [1.9.12-01] |
516 |
|
|
- Add 90adjustDenyLog fragment missed in last commit. [charlieb 4501] |
517 |
|
|
|
518 |
|
|
* Mon Aug 19 2002 Charlie Brady <charlieb@e-smith.com> |
519 |
|
|
- [1.9.11-01] |
520 |
|
|
- Further re-arrangement to facilitate non-disruptive update of filtering |
521 |
|
|
rules. [charlieb 4501] |
522 |
|
|
|
523 |
|
|
* Fri Aug 16 2002 Charlie Brady <charlieb@e-smith.com> |
524 |
|
|
- [1.9.10-01] |
525 |
|
|
- Remove 98adjust, and split it into 49adjustStart, 50adjustTCP and 51adjustEnd |
526 |
|
|
fragments. Migrate network stack tuning stuff to sysctl.conf templates. |
527 |
|
|
Add TOS adjustment stuff. [charlieb 4501] |
528 |
|
|
|
529 |
|
|
* Thu Aug 15 2002 Charlie Brady <charlieb@e-smith.com> |
530 |
|
|
- [1.9.9-01] |
531 |
|
|
- Change masq template fragments to allow non-disruptive modification. |
532 |
|
|
Add "masq adjust" verb. [charlieb 4501] |
533 |
|
|
|
534 |
|
|
* Thu Aug 8 2002 Charlie Brady <charlieb@e-smith.com> |
535 |
|
|
- [1.9.8-01] |
536 |
|
|
- Remove deprecated split in masq template fragment, and add FIXME comment |
537 |
|
|
to code which looks to be wrong. [charlieb 1268] |
538 |
|
|
|
539 |
|
|
* Wed Jul 31 2002 Charlie Brady <charlieb@e-smith.com> |
540 |
|
|
- [1.9.7-01] |
541 |
|
|
- Use iptables state tracking to allow return traffic. Remove special |
542 |
|
|
rules set up to allow the return traffic. [charlieb 4499] |
543 |
|
|
|
544 |
|
|
* Tue Jul 23 2002 Charlie Brady <charlieb@e-smith.com> |
545 |
|
|
- [1.9.6-01] |
546 |
|
|
- Allow local and masqueraded traffic on forward chain. Fix syntax for denylog |
547 |
|
|
chain. [charlieb 1268] |
548 |
|
|
|
549 |
|
|
* Thu Jul 18 2002 Charlie Brady <charlieb@e-smith.com> |
550 |
|
|
- [1.9.5-01] |
551 |
|
|
- Avoid a perl warning from use of ${httpd-e-smith}{status} - |
552 |
|
|
change to ${'httpd-e-smith'}{status}. [charlieb 1268] |
553 |
|
|
|
554 |
|
|
* Wed Jul 17 2002 Charlie Brady <charlieb@e-smith.com> |
555 |
|
|
- [1.9.4-01] |
556 |
|
|
- Change syntax from ipchains (2.2 kernel) to iptables (2.4 kernel). |
557 |
|
|
[charlieb 1268] |
558 |
|
|
- Add "status" option to list tables. |
559 |
|
|
- Miscellaneous syntax cleanups. |
560 |
|
|
|
561 |
|
|
* Tue Jul 2 2002 Charlie Brady <charlieb@e-smith.com> |
562 |
|
|
- [1.9.3-01] |
563 |
|
|
- Add "modprobe ipchains" to allow firewall to work with 2.4 kernel |
564 |
|
|
[charlieb 4223] |
565 |
|
|
|
566 |
|
|
* Fri Jun 21 2002 Mark Knox <markk@e-smith.com> |
567 |
|
|
- [1.9.2-01] |
568 |
|
|
- Allow ICMP from all "local" networks, not just physical LAN [markk 3698] |
569 |
|
|
|
570 |
|
|
* Fri Jun 21 2002 Mark Knox <markk@e-smith.com> |
571 |
|
|
- [1.9.1-01] |
572 |
|
|
- Allow ICMP on internal interface [markk 3698] |
573 |
|
|
|
574 |
|
|
* Wed Jun 5 2002 Charlie Brady <charlieb@e-smith.com> |
575 |
|
|
- [1.9.0-01] |
576 |
|
|
- Changing version to maintained stream number to 1.9.0 |
577 |
|
|
|
578 |
|
|
* Fri May 31 2002 Charlie Brady <charlieb@e-smith.com> |
579 |
|
|
- [1.8.0-01] |
580 |
|
|
- Changing version to maintained stream number to 1.8.0 |
581 |
|
|
|
582 |
|
|
* Thu May 23 2002 Gordon Rowell <gordonr@e-smith.com> |
583 |
|
|
- [1.7.3-01] |
584 |
|
|
- RPM rebuild forced by cvsroot2rpm |
585 |
|
|
|
586 |
|
|
* Fri May 10 2002 Charlie Brady <charlieb@e-smith.com> |
587 |
|
|
- [1.7.2-01] |
588 |
|
|
- Remove 45AllowSMTP - moved to e-smith-mailfront. [charlieb 3419] |
589 |
|
|
|
590 |
|
|
* Fri May 10 2002 Charlie Brady <charlieb@e-smith.com> |
591 |
|
|
- [1.7.1-01] |
592 |
|
|
- No change. Test build of CVS conversion. |
593 |
|
|
|
594 |
|
|
* Fri May 10 2002 Charlie Brady <charlieb@e-smith.com> |
595 |
|
|
- [1.7.0-01] |
596 |
|
|
- rollRPM: Rolled version number to 1.7.0-01. Includes patches up to 1.6.0-02. |
597 |
|
|
|
598 |
|
|
* Wed Dec 19 2001 Charlie Brady <charlieb@e-smith.com> |
599 |
|
|
- [1.6.0-02] |
600 |
|
|
- Restore run time lookup of ExternalIP by /etc/rc.d/init.d/masq. |
601 |
|
|
- Make sure that OUTERNET is set to a valid IP address, even if |
602 |
|
|
ExternalIP is not set in config db, to avoid syntax errors in |
603 |
|
|
ipchains command in masq script. |
604 |
|
|
|
605 |
|
|
* Tue Dec 11 2001 Jason Miller <jay@e-smith.com> |
606 |
|
|
- [1.6.0-01] |
607 |
|
|
- rollRPM: Rolled version number to 1.6.0-01. Includes patches up to 1.5.0-05. |
608 |
|
|
|
609 |
|
|
* Thu Dec 06 2001 Charlie Brady <charlieb@e-smith.com> |
610 |
|
|
- [1.5.0-05] |
611 |
|
|
- Add support for ippp0 as the external interface - if sync ISDN is used. |
612 |
|
|
|
613 |
|
|
* Wed Nov 21 2001 Adrian Chung <adrianc@e-smith.com> |
614 |
|
|
- [1.5.0-04] |
615 |
|
|
- Add $OUT = "" to 01localNetworks so that '1' isn't output |
616 |
|
|
into template when 01localNetworks generates no output. |
617 |
|
|
|
618 |
|
|
* Wed Nov 21 2001 Adrian Chung <adrianc@e-smith.com> |
619 |
|
|
- [1.5.0-03] |
620 |
|
|
- Splitting @locals and $primaryLocalNet generation out of |
621 |
|
|
40AllowLocals into 01localNetworks. |
622 |
|
|
- transproxy fragment from e-smith-proxy needs these variables in |
623 |
|
|
35transproxy. |
624 |
|
|
|
625 |
|
|
* Tue Nov 06 2001 Charlie Brady <charlieb@e-smith.com> |
626 |
|
|
- [1.5.0-02] |
627 |
|
|
- Fix variable naming error in setting up @locals array. |
628 |
|
|
- Remove forwarding rules from stopmasq section - and remove the 'stop' |
629 |
|
|
alias for this case - there is a separate stop section of the script. |
630 |
|
|
- Add bidirectional forwarding rules for each local network to our network. |
631 |
|
|
This both enables the forwarded traffic, and also prevents masquerading |
632 |
|
|
of the local traffic. |
633 |
|
|
|
634 |
|
|
* Mon Nov 5 2001 Charlie Brady <charlieb@e-smith.com> |
635 |
|
|
- [1.5.0-01] |
636 |
|
|
- Rolled version number to 1.5.0-01. Includes patches upto 1.4.0-02. |
637 |
|
|
|
638 |
|
|
* Mon Oct 29 2001 Charlie Brady <charlieb@e-smith.com> |
639 |
|
|
- [1.4.0-02] |
640 |
|
|
- Allow packet forwarding from localnet to localnet in serveronly mode - |
641 |
|
|
this is necessary for PPTP VPN termination. |
642 |
|
|
|
643 |
|
|
* Thu Aug 23 2001 Gordon Rowell <gordonr@e-smith.com> |
644 |
|
|
- [1.4.0-01] |
645 |
|
|
- Rolled version number to 1.4.0-01. Includes patches upto 1.3.0-08. |
646 |
|
|
|
647 |
|
|
* Fri Aug 17 2001 gordonr |
648 |
|
|
- [1.3.0-08] |
649 |
|
|
- Autorebuild by rebuildRPM |
650 |
|
|
|
651 |
|
|
* Mon Aug 13 2001 Adrian Chung <adrianc@e-smith.com> |
652 |
|
|
- [1.3.0-07] |
653 |
|
|
- Apply the patch. :) |
654 |
|
|
|
655 |
|
|
* Fri Aug 10 2001 Adrian Chung <adrianc@e-smith.com> |
656 |
|
|
- [1.3.0-06] |
657 |
|
|
- Multicast range is 224.0.0.0 to 239.255.255.255 which |
658 |
|
|
is 224.0.0.0/4 not 224.0.0.0/3. |
659 |
|
|
224.0.0.0/3 covers 255.255.255.255 which denies DHCP traffic |
660 |
|
|
|
661 |
|
|
* Mon Apr 21 2001 Gordon Rowell <gordonr@e-smith.com> |
662 |
|
|
- [1.3.0-05] |
663 |
|
|
- Putback Charlie's change to add Stealth property to masq service, defaulting |
664 |
|
|
to "no". If set to "yes", external ICMP echo packets are ignored. |
665 |
|
|
|
666 |
|
|
* Sat Apr 07 2001 Gordon Rowell <gordonr@e-smith.com> |
667 |
|
|
- [1.3.0-04] |
668 |
|
|
- Forward port patches from 1.2.0-01 to 1.2.0-06 |
669 |
|
|
|
670 |
|
|
* Sun Mar 25 2001 Gordon Rowell <gordonr@e-smith.com> |
671 |
|
|
- [1.2.0-06] |
672 |
|
|
- Two new properties of masq service - PermitHighUDP and PermitHighTCP. |
673 |
|
|
Both default to "yes", but provide an easy way to block unprivileged |
674 |
|
|
TCP/UDP or both. |
675 |
|
|
|
676 |
|
|
* Fri Mar 23 2001 Gordon Rowell <gordonr@e-smith.com> |
677 |
|
|
- [1.2.0-05] |
678 |
|
|
- Default auth/smtp/http[s] to public for backwards compatability |
679 |
|
|
|
680 |
|
|
* Fri Mar 23 2001 Gordon Rowell <gordonr@e-smith.com> |
681 |
|
|
- [1.2.0-04] |
682 |
|
|
- masq service now has an optional property Logging, defaulting to "none" |
683 |
|
|
- Only log denied packets if Logging is other than "none" - this stops |
684 |
|
|
logging of the SMB chatter on cable and other shared networks |
685 |
|
|
- Ignore SMB and RIP packets unless Logging is "all" |
686 |
|
|
|
687 |
|
|
* Thu Mar 22 2001 Gordon Rowell <gordonr@e-smith.com> |
688 |
|
|
- [1.2.0-03] |
689 |
|
|
- Check access property for httpd-e-smith/smtpd/identd |
690 |
|
|
|
691 |
|
|
* Wed Mar 7 2001 Adrian Chung <adrianc@e-smith.com> |
692 |
|
|
- [1.3.0-03] |
693 |
|
|
- set rp_filter to 0 for 'all' interface as well. |
694 |
|
|
|
695 |
|
|
* Wed Mar 7 2001 Adrian Chung <adrianc@e-smith.com> |
696 |
|
|
- [1.3.0-02] |
697 |
|
|
- set rp_filter to 0 for 'default' interface, explicitly set |
698 |
|
|
it to 1 for eth0, eth1. |
699 |
|
|
- ipsec-restart will set eth1 to '0'. |
700 |
|
|
|
701 |
|
|
* Wed Mar 7 2001 Adrian Chung <adrianc@e-smith.com> |
702 |
|
|
- [1.3.0-01] |
703 |
|
|
- branching to development stream. |
704 |
|
|
|
705 |
|
|
* Thu Feb 8 2001 Adrian Chung <adrianc@e-smith.com> |
706 |
|
|
- [1.2.0-02] |
707 |
|
|
- Rolling release number for GPG signing. |
708 |
|
|
|
709 |
|
|
* Thu Jan 25 2001 Peter Samuel <peters@e-smith.com> |
710 |
|
|
- [1.2.0-01] |
711 |
|
|
- Rolled version number to 1.2.0-01. Includes patches upto 1.1.0-16. |
712 |
|
|
|
713 |
|
|
* Thu Jan 25 2001 Adrian Chung <adrianc@e-smith.com> |
714 |
|
|
- [1.1.0-16] |
715 |
|
|
- removed 35DenyUnrouteable fragment, since it affects |
716 |
|
|
us, and anyone else using a provider who masquerades |
717 |
|
|
connections. |
718 |
|
|
|
719 |
|
|
* Wed Jan 24 2001 Charlie Brady <charlieb@e-smith.com> |
720 |
|
|
- [1.1.0-15] |
721 |
|
|
- Remove AllowFTP fragment - moved to e-smith-proftpd. |
722 |
|
|
|
723 |
|
|
* Thu Jan 18 2001 Adrian Chung <adrianc@e-smith.com> |
724 |
|
|
- [1.1.0-14] |
725 |
|
|
- adjusted 45AllowFTP to follow value of FTP accessLimits instead |
726 |
|
|
of service status. |
727 |
|
|
|
728 |
|
|
* Mon Dec 18 2000 Gordon Rowell <gordonr@e-smith.com> |
729 |
|
|
- [1.1.0-13] |
730 |
|
|
- Added use esmith::db |
731 |
|
|
|
732 |
|
|
* Mon Dec 18 2000 Gordon Rowell <gordonr@e-smith.com> |
733 |
|
|
- [1.1.0-12] |
734 |
|
|
- Backed out -11 patch - not required |
735 |
|
|
- Reordered fragments |
736 |
|
|
|
737 |
|
|
* Mon Dec 18 2000 Gordon Rowell <gordonr@e-smith.com> |
738 |
|
|
- [1.1.0-11] |
739 |
|
|
- Added source/destination to icmp rules |
740 |
|
|
|
741 |
|
|
* Fri Dec 15 2000 Gordon Rowell <gordonr@e-smith.com> |
742 |
|
|
- [1.1.0-10] |
743 |
|
|
- Added protocol option to icmp fragments |
744 |
|
|
- Removed masqstart/masqstop |
745 |
|
|
- Allowed icmp echo-request and echo-reply |
746 |
|
|
|
747 |
|
|
* Fri Dec 15 2000 Gordon Rowell <gordonr@e-smith.com> |
748 |
|
|
- [1.1.0-9] |
749 |
|
|
- Rearranged fragments |
750 |
|
|
- Split some rules into new chains |
751 |
|
|
- Added extra ICMP rules |
752 |
|
|
|
753 |
|
|
* Fri Dec 15 2000 Charlie Brady <charlieb@e-smith.com> |
754 |
|
|
- [1.1.0-8] |
755 |
|
|
- Move AllowSSH template fragment to e-smith-openssh. |
756 |
|
|
- Fix uninitialised value problem in 15Definitions. |
757 |
|
|
|
758 |
|
|
* Tue Dec 12 2000 Gordon Rowell <gordonr@e-smith.com> |
759 |
|
|
- [1.1.0-7] |
760 |
|
|
- Normalised AUTH template and fixed HTTP[S] templates |
761 |
|
|
|
762 |
|
|
* Tue Dec 12 2000 Gordon Rowell <gordonr@e-smith.com> |
763 |
|
|
- [1.1.0-6] |
764 |
|
|
- Used hard-quote form of HERE documents to avoid $ expansions |
765 |
|
|
|
766 |
|
|
* Tue Dec 12 2000 Gordon Rowell <gordonr@e-smith.com> |
767 |
|
|
- [1.1.0-5] |
768 |
|
|
- Normalised structure of 45Allow* fragments |
769 |
|
|
- Moved 45AllowIONonPriv to 46AllowIONonPriv |
770 |
|
|
|
771 |
|
|
* Tue Dec 12 2000 Gordon Rowell <gordonr@e-smith.com> |
772 |
|
|
- [1.1.0-4] |
773 |
|
|
- Fixed service name in templates - imapd -> imap |
774 |
|
|
- Changed mode -> access |
775 |
|
|
|
776 |
|
|
* Tue Dec 12 2000 Gordon Rowell <gordonr@e-smith.com> |
777 |
|
|
- [1.1.0-3] |
778 |
|
|
- Rewrote 15definitions and 45* fragments which checked services entries |
779 |
|
|
|
780 |
|
|
* Tue Dec 05 2000 Gordon Rowell <gordonr@e-smith.com> |
781 |
|
|
- [1.1.0-2] |
782 |
|
|
- Determine ExternalIP at run time |
783 |
|
|
- Modified templates to check services entries |
784 |
|
|
- Added COPYING file and GPL Copyright |
785 |
|
|
|
786 |
|
|
* Tue Dec 05 2000 Gordon Rowell <gordonr@e-smith.com> |
787 |
|
|
- [1.1.0-1] |
788 |
|
|
- Rolled version and tarball including patches to 0.1-4 |
789 |
|
|
- Used e-smith-devtools |
790 |
|
|
|
791 |
|
|
* Thu Nov 30 2000 Gordon Rowell <gordonr@e-smith.com> |
792 |
|
|
- [0.1-4] |
793 |
|
|
- Changes to match change to pppoe service |
794 |
|
|
|
795 |
|
|
* Wed Nov 29 2000 Gordon Rowell <gordonr@e-smith.com> |
796 |
|
|
- Handle ppp0 as external interface for PPPoE setups |
797 |
|
|
|
798 |
|
|
* Tue Nov 21 2000 Charlie Brady <charlieb@e-smith.com> |
799 |
|
|
- Remove extraneous } in 15definitions |
800 |
|
|
|
801 |
|
|
* Sun Nov 19 2000 Charlie Brady <charlieb@e-smith.com> |
802 |
|
|
- initial release |
803 |
|
|
|
804 |
|
|
%prep |
805 |
|
|
%setup |
806 |
|
|
|
807 |
|
|
%build |
808 |
|
|
perl createlinks |
809 |
|
|
|
810 |
|
|
%install |
811 |
|
|
rm -rf $RPM_BUILD_ROOT |
812 |
|
|
|
813 |
|
|
for file in masq |
814 |
|
|
do |
815 |
|
|
mkdir -p root/etc/e-smith/templates/etc/rc.d/init.d/$file |
816 |
|
|
ln -s /etc/e-smith/templates-default/template-begin-shell \ |
817 |
|
|
root/etc/e-smith/templates/etc/rc.d/init.d/$file/template-begin |
818 |
|
|
done |
819 |
|
|
|
820 |
|
|
(cd root ; find . -depth -print | cpio -dump $RPM_BUILD_ROOT) |
821 |
|
|
mkdir -p $RPM_BUILD_ROOT/var/log/iptables |
822 |
|
|
mkdir -p $RPM_BUILD_ROOT/service |
823 |
|
|
ln -s /var/service/ulogd $RPM_BUILD_ROOT/service/ulogd |
824 |
|
|
/sbin/e-smith/genfilelist $RPM_BUILD_ROOT \ |
825 |
|
|
--dir /var/service/ulogd 'attr(1755,root,root)' \ |
826 |
|
|
--file /var/service/ulogd/run 'attr(0755,root,root)' \ |
827 |
|
|
--dir /var/service/ulogd/log 'attr(0755,root,root)' \ |
828 |
|
|
--file /var/service/ulogd/log/run 'attr(0755,root,root)' \ |
829 |
|
|
--dir /var/log/iptables 'attr(0755,smelog,smelog)' \ |
830 |
|
|
> e-smith-%{version}-filelist |
831 |
|
|
echo "%doc COPYING" >> e-smith-%{version}-filelist |
832 |
|
|
|
833 |
|
|
%clean |
834 |
|
|
rm -rf $RPM_BUILD_ROOT |
835 |
|
|
|
836 |
|
|
%files -f e-smith-%{version}-filelist |
837 |
|
|
%defattr(-,root,root) |